Last Updated: 2026-09-16T20:26:00Z
CVSSv3: 10
What’s Happening
Cisco disclosed a “perfect ten” critical authentication bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE PIC), tracked as CVE-2026-76460. The bug is in an API endpoint with weak authentication controls. An unauthorized attacker can remotely send a request and bypass the management interface without logging in. Successful exploitation gives you root access.
While there is a patch, there is currently no workaround. Cisco PSIRT says it’s already being exploited, and it is already in CISA’s KEV Known Exploited Vulnerabilities catalog.
This advisory is part of a wider “hardening” release from Cisco, which also includes a related security hardening advisory covering multiple other discovered vulnerabilities.
Actions
Patch immediately. Fixed releases:
| Release | First Fixed |
|---|---|
| 3.1 | Patch 12 |
| 3.2 | Patch 11 |
| 3.3 | Patch 12 |
| 3.4 | Patch 7 |
| 3.5 | Patch 4 |
Release 3.0 and prior will need to be upgraded to a supported release version to receive the patch.
There is no workaround, but Cisco recommends locking down the service with iACLs if you cannot patch right away. This does not fix the bug, just limits the attack surface.
Given the confirmed exploitation, check access.log on every node for suspicious usernames: admin#show logging application ise-kong/access.log | include dummyuser. For the fuller picture, collect a support bundle with debug logs, use shared key encryption, then decrypt and look at ./ise/logs/apigateway/access.log.*.gz.
Attackers who get in can obtain root, so do not trust logs on the box alone. Cross check external network and firewall logs for unexpected outbound connections from ISE appliances. If you find anything, reimage the affected nodes after taking a backup/snapshot and restore from a known good configuration backup.
Notes
The companion hardening advisory covers additional vulnerabilities addressed in this release.
